The EU AI Act for Cyprus fintechs: what applies, and when

Yes. The EU AI Act is a regulation, so it applies directly in Cyprus without national transposition, alongside GDPR, DORA and the rules of CySEC and the Central Bank of Cyprus. It applies to providers — organizations that develop an AI system and place it on the market or put it into service under their own name — and to deployers, organizations that use an AI system under their own authority.

Many fintechs are both. A payment institution that builds a credit model in-house and uses it on its own customers is the provider and the deployer of that system. A broker that licenses a third-party AI tool is a deployer, with a narrower set of obligations.

The Digital Omnibus on AI — proposed by the European Commission on 19 November 2025, given final approval by the Council on 29 June 2026 and published as Regulation (EU) 2026/1744 — postponed the high-risk deadlines that most firms had been planning around. The dates that matter for fintechs are now:

Many guides written before July 2026 still give 2 August 2026 as the high-risk deadline. That date no longer applies to Annex III systems. The final Omnibus text set fixed dates rather than linking them to the availability of technical standards.

Annex III, point 5 lists two financial uses as high-risk: AI used to evaluate the creditworthiness of natural persons or establish their credit score — "with the exception of AI systems used for the purpose of detecting financial fraud" — and AI used for risk assessment and pricing of natural persons in life and health insurance. Common fintech use cases are classified as follows:

One rule catches firms out. Under Article 6(3), a system listed in Annex III is not treated as high-risk if it does not materially influence decisions — for example, if it only performs a narrow procedural or preparatory task. But an Annex III system that profiles natural persons is always high-risk.

Providers of high-risk AI systems must have the following in place before the system is placed on the market or put into service:

• A risk-management system running across the system's lifecycle (Article 9).
• Data governance for training, validation and test data, including examination for possible bias (Article 10).
• Technical documentation (Article 11) and automatic logging of events (Article 12).
• Instructions and transparency for deployers (Article 13) and design for effective human oversight (Article 14).
• Appropriate accuracy, robustness and cybersecurity (Article 15).
• A quality-management system (Article 17), a conformity assessment and registration in the EU database (Article 49).

Deployers must use the system according to its instructions, assign human oversight to competent people, monitor its operation and keep the logs under their control (Article 26). Deployers of credit-scoring and insurance-pricing systems must also carry out a fundamental rights impact assessment before first use (Article 27). The Act lets regulated financial institutions meet some of these duties through their existing internal-governance arrangements under EU financial services law.

Penalties are significant: up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and up to €15 million or 3% for breaches of most other obligations (Article 99).

The AI Act adds to the rules fintechs already follow; it does not replace them:

1. 01Build an AI inventory. List every model and AI tool in use — in-house, vendor-supplied and embedded in software — with an owner and a purpose.
2. 02Classify each use case. Map it against Article 5 (prohibited), Annex III (high-risk), Article 50 (transparency) and the Article 6(3) conditions, and record the reasoning.
3. 03Decide your role. For each system, establish whether you are the provider, the deployer or both.
4. 04Close the documentation gap. Start technical documentation, data lineage and logging now for systems that will be high-risk from December 2027.
5. 05Design human oversight. Define who reviews which outputs, with what authority to override, and how that is evidenced.
6. 06Update vendor contracts. Align AI vendor contracts with DORA's mandatory clauses and with the information you will need from AI providers.
7. 07Train your people. Make sure staff who build, buy or use AI understand its capabilities, its limits and the firm's policy.
8. 08Monitor and review. Track model performance, drift and incidents, and revisit classifications whenever a use case changes.

Keap Technologies helps fintechs in Cyprus and across the EU with the technical side of this plan — AI inventories, model documentation, explainability and monitoring — and builds new credit and fraud models and GenAI systems with these requirements designed in. Talk to us.